What does an ISMS owner do?
- Keeps the annual calendar: risk reviews, access reviews, supplier checks, internal audit, management review.
- Chases actions and corrective actions to closure, with evidence.
- Makes sure change (new systems, suppliers, services, people) triggers risk and SoA updates.
- Keeps evidence accumulating where it can be retrieved in minutes at surveillance.
- Reports upward honestly, including when the system is drifting.
The owner needs standing more than technical depth: a coordinator who makes sure technical controls (held by IT and suppliers) are decided, done and evidenced.
Who should you choose as ISMS owner?
| Candidate | Strength | Watch for |
|---|---|---|
| Operations or compliance lead | Process discipline, diary control, cross-functional reach | Needs access to senior security judgement for risk decisions |
| IT manager | Understands systems and suppliers | System can shrink into a technical checklist; governance starves |
| Founder or director (small firms) | Authority is unquestioned | Time evaporates; deputy arrangements matter most here |
| External vCISO owning the programme | Seniority, audit-side experience, continuity | Management must still visibly own decisions; see below |
How much time does ISMS ownership take?
For a small certified organisation with a sensible system, coordination is typically a few hours a month, rising around internal audit, management review and the external visit. If your ISMS needs days a week of upkeep, simplify it (fewer, lived policies; automated evidence where systems provide it) before you add headcount.
My maintenance guide lays out the rhythm month by month.
When does outsourcing the ISMS programme make sense?
When nobody internal has the standing or the time, when the previous owner has left, or when surveillance findings have shown what drift costs, outsourcing the programme makes sense. A virtual CISO then owns the calendar and the evidence while your leadership keeps the decisions the standard reserves to it; my ongoing brief at Chaucer works exactly this way.
It starts with a review of where the system stands today, and it is the core of my ongoing CISO services.